## What changed
- Add `thread/attachment/add`, `thread/attachment/list`, and `thread/attachment/remove` to manage durable resource references without loading the owning thread or changing conversation history.
- Identify attachments by thread, `attachmentType`, and `identityKey`. Repeated adds return the existing attachment; repeated removals succeed without emitting another update. Listing supports cursor pagination.
- Broadcast `thread/attachment/updated` after creation or deletion, after responding to the requester. Serialize attachment mutations with thread lifecycle operations and reject stores that do not support attachments.
- Update protocol schemas, TypeScript and Python bindings, documentation, and TUI notification handling so attachment updates do not add untracked threads to the agent picker.
## Testing
Add coverage for unloaded threads, pagination, idempotent addition and removal, reattachment, invalid inputs, unsupported stores, response-before-notification ordering across clients, and TUI notification routing.
GitOrigin-RevId: 0d29cf903afd4e931a70a9cf96300475213b34aa
## What changed
Add nullable `promptHash` to the upload response, populated from the uploaded `prompt_hash` tag. It identifies the whitespace-normalized SHA-256 of the session base instructions, excludes later developer messages, and is `null` when the reported rollout has no prompt metadata.
Update the protocol schemas, precomputed exports, and generated TypeScript and Python types.
GitOrigin-RevId: 6fa70fbe7a06604ac1cd0ea363eb4f192083dad9
## Why
Guardian approval actions can contain paths from a remote executor whose path convention differs from the host, such as Windows paths reviewed on a POSIX host. Converting those paths to host-native absolute paths prevents the action from being reviewed.
## What changed
- Render command working directories using the executor's reported path convention, and preserve URI-backed paths for attribution.
- Carry foreign command and patch paths through Guardian events and app-server schemas as legacy path strings.
- Bound remote plugin attribution within the overall review deadline and reject Guardian action payloads that exceed the review byte limit.
## Testing
- Cover Windows and POSIX executor path rendering, foreign patch paths, protocol round trips, oversized payload rejection, and remote Guardian review context.
GitOrigin-RevId: 38be0fcdac897139519e74e077eb5cb4f8f8017e
## What changed
- Parse the optional `[browser_use].allow_webmcp` boolean from managed requirements and preserve requirement-layer precedence.
- Return the policy as `browserUse.allowWebmcp` from `configRequirements/read`, including explicit `true`, explicit `false`, and `null` when omitted.
- Update the generated JSON and TypeScript protocol schemas.
## Testing
- Cover parsing, invalid values, layered overrides, and app-server response serialization.
GitOrigin-RevId: a3fd7d1a6f838bb3ab0ac2a644409101a2338ca6
## What changed
- Emit a connection-scoped `deprecationNotice` when `review/start` uses
`delivery: "detached"`, including when validation later rejects the request.
- Preserve detached review behavior while directing callers to use `thread/start`
followed by an inline review for a separate review thread.
- Document the deprecation and migration options in the app-server protocol and
README.
## Testing
- Cover the notice for accepted and rejected detached reviews.
- Verify that omitted, null, and inline delivery do not emit the notice.
GitOrigin-RevId: 4234a09d2bb7ef8053091580175dc8cbe8d7512c
## Why
An empty tool map does not distinguish a successfully returned empty catalog from a server whose startup or tool discovery failed.
## What changed
- Add nullable `toolsError` to each `mcpServerStatus/list` entry when no catalog is available because startup or tool discovery failed.
- Keep `toolsError` null for returned catalogs, including cached and empty catalogs, and continue returning healthy servers when another server fails.
- Update the protocol schemas and generated TypeScript type.
## Testing
- Extend the app-server status integration test with a broken MCP server and verify its error without losing the healthy server's inventory.
GitOrigin-RevId: 30b4ca4d9a45cec6998f5f626d3fddbee90a525d
## What changed
- Add the creation-time `originator` to app-server thread responses and `thread/started` notifications.
- Persist originators in thread metadata and preserve the first recorded value across list, read, resume, rollout, and SQLite paths.
- Add an `originators` allowlist to `thread/list` for hosted backends. The local app-server accepts omitted or empty values but rejects nonempty filters.
## Testing
- Cover originator persistence across server restarts and list, read, and resume requests.
- Verify local `thread/list` handling for nonempty, omitted, null, and empty originator filters.
- Heap-allocate large TUI dispatcher futures in affected tests to keep them within the Windows test-thread stack.
GitOrigin-RevId: 73ad6e61b8fdd2d93a22d1f971723a19ec7be3fc
## What changed
- Add `application.network` managed requirements with exact-domain allow/deny
rules, default-enabled behavior, domain normalization, and normal managed TOML
precedence.
- Return the policy separately from agent network requirements through the
experimental `configRequirements/read` API. The endpoint reports the policy
but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.
## Testing
- Cover parsing, validation, normalization, layered precedence, and cloud
requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
rejection of invalid domains.
GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b
## What changed
- Add the experimental `Thread.environments` field with each selected environment's ID, working directory, and runtime workspace roots.
- Populate the field from live thread state in start, resume, read, list, and unarchive responses. Use `null` for unloaded threads and an empty list when a loaded thread has no environment selection.
- Document that the field reports selection rather than connection status and does not affect executor selection or resume behavior.
## Testing
- Cover selection updates, unloaded and resumed threads, loaded pathless unarchives, and clients that subscribe after environment connection notifications.
GitOrigin-RevId: a6daa06aff7089d7c5a1e4c7d03109b41f12fa3c
## Why
When ordinary included usage is exhausted, eligible users need a way to keep working with the backend-provided Luna Reserve quota and return to their previous model once ordinary usage recovers.
## What changed
- Automatically switch eligible TUI tasks to Luna Reserve after an authoritative account usage read, preserving the prior model and reasoning effort per task.
- Restrict model selection while on Reserve to its supported reasoning levels, keep queued turns on the accepted model, and restore the saved model after a fresh read confirms recovery.
- Surface Reserve usage in the composer and `/status`, and expose `normalModelSlug` in app-server rate-limit snapshots so clients can use the associated model's display metadata without changing the request model.
- Poll account limits more frequently near exhaustion and retain compatibility with app servers that only accept the legacy null request parameters.
## Testing
- Added coverage for Reserve entry, queued-turn handling, task reconstruction, recovery authorization, account changes, model selection, usage rendering, and banner dismissal.
GitOrigin-RevId: 46a435e9531051f8cec3f6a46c4b9f7cfa479747
## What changed
- Accept optional `account/rateLimits/read` capabilities for Luna Reserve support
and lightweight background polling while preserving omitted and `null` params.
- Forward the Luna Reserve capability only for eligible ChatGPT sessions, and let
lightweight polls skip the separate reset-credit detail request.
- Return the backend's `ordinaryUsageAllowed` decision only when its account and
user identity match the active session.
## Testing
- Cover capability defaults, eligible and restricted authentication modes,
lightweight polling, identity filtering, and backend permission handling.
GitOrigin-RevId: f407a3ae1e70e411fdf245f072a16e453f59cd87
## Why
Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.
## What changed
- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.
## Testing
- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.
GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939
## Why
Permission requests can originate in an environment whose path convention differs from the Codex host. Requiring the request working directory to be host-native prevents those requests from reaching interactive approval.
## What changed
- Carry the request `cwd` as a `LegacyAppPathString` through core events and the app-server protocol so the target environment's native representation is preserved.
- Convert the preserved value back to a `PathUri` when materializing permission grants.
- Regenerate the JSON and TypeScript protocol schemas for the updated `cwd` type.
## Testing
- Exercise the app-server permission request round trip with a target-native working directory across host path conventions.
- Verify remote permission requests retain their environment working directory and granted access still unblocks later execution.
GitOrigin-RevId: 97dc9707d9048883d20bab1b69c93871039f3188
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## What changed
- Add nullable `model` and `reasoningEffort` fields to the shared app-server `Thread` object and generated schemas.
- Report current settings for loaded threads and the latest persisted settings for unloaded threads across thread read, list, start, resume, rollback, metadata update, and notification paths.
- Keep unavailable legacy or filesystem-only settings nullable, and allow metadata reads without loading a thread or dispatching queued work.
## Testing
- Cover live-setting precedence, persisted settings after restart, null legacy values, and model metadata returned by thread lifecycle operations.
GitOrigin-RevId: 22ebe8a8d1910a820d90a97730d812a00d8c1372
## What changed
- Add `apps.<app_id>.links.<link_id>` configuration for overriding
`approvals_reviewer` and `default_tools_approval_mode` per connected account.
- Expose link settings through the app-server protocol and generated JSON and
TypeScript schemas.
## Testing
- Extend `config/read` coverage for populated, empty, and absent `links`
sections.
GitOrigin-RevId: 43004d2722439060fdadc5e5cd9ed3108774ecaf
## What changed
- Include the complete upstream `response.usage` object in
`ResponseUsageMetadata.metadata` while retaining the existing `amount` field.
- Expose the metadata through `rawResponse/completed` notifications and update
the generated JSON and TypeScript schemas.
## Testing
- Cover SSE, WebSocket, turn, and compaction completion paths.
GitOrigin-RevId: 6d79b1b4c92ac11abf43ec98f380b4868288a701
## What changed
- Add the `plugin/reconcile` JSON-RPC method to synchronize installed remote plugin bundles and wait for required hook updates.
- Return affected plugin IDs with MCP, Apps, hooks, and skills refresh hints, plus remote update and materialization failures.
- Refresh loaded hook runtimes after relevant updates and return an empty result when plugins or backend authentication are unavailable.
## Testing
- Cover workspace and global bundle installs, unchanged passes, enablement changes, updates, removals, materialization failures, hook refreshes, and disabled plugins.
GitOrigin-RevId: 45c02518d71990d13eb09d56ed51505c91c66956
## What changed
- Carry optional backend-owned banner and account identity data through
`account/rateLimits/read`, filtering banners that do not match the authenticated
account and user.
- Render supported rate-limit notices above the composer with actions for usage,
credits, resets, owner notifications, and plan management while preserving the
existing fallback UI for absent or unsupported banners.
- Refresh usage after limit errors, reject stale responses, and keep queued input
paused until recovery completes. When instructed by the banner, switch to the
first available fallback model without changing unrelated thread settings.
## Testing
- Add protocol, banner parsing and rendering, CTA, identity filtering, refresh
ordering, fallback-model, account-change, and queued-input recovery coverage.
GitOrigin-RevId: e03d75a82e425deb87f4b120a71cf2286c0ef6cc
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## What changed
- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.
## Testing
- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.
GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495
## What changed
- Emit turn-scoped authentication recovery started and completed events when a model provider refreshes expired credentials.
- Add stable `modelProvider/authRecoveryStarted` and `modelProvider/authRecoveryCompleted` app-server notifications with the thread, turn, provider, and user-facing message.
- Show recovery progress in the TUI and `codex exec`, including Amazon Bedrock session reauthentication.
## Testing
- Cover provider recovery success and failure events, app-server routing, client rendering, and Amazon Bedrock credential refresh.
GitOrigin-RevId: 3010c38d0676f18bced27761cf86dd38344d09f9
## What changed
- Include `recencyAt`, derived from the newest non-archived assigned thread, in project responses.
- Let `project/list` sort by `position` or `recencyAt` in either direction, with recency as the default descending order for that key and projects without activity placed last.
- Encode the sort key, direction, and millisecond-precision anchor in new cursors while retaining existing ascending-position cursors.
- Add an index for project recency lookups and document the API's sorting and pagination behavior.
## Testing
- Cover recency updates when threads are assigned, archived, unarchived, or deleted.
- Cover ordering, null handling, tie-breaking, cursor pagination, invalid sort combinations, and cursor mismatches.
GitOrigin-RevId: 6165e2b9976b0b45cfa16bcd42978b67811f6df5
## What changed
- Parse optional `usage_metadata.amount` values from Responses API completion events without converting their string representation.
- Propagate the metadata through SSE and WebSocket streams, regular turns, and remote compaction.
- Add `usageMetadata` to the app-server `rawResponse/completed` notification and its generated schemas.
## Testing
- Cover missing, null, zero, and high-precision amounts, including completion events emitted during compaction.
GitOrigin-RevId: b16d81e8350eab0dc7ff613d0dc9dbed73041713
## What changed
- Add an optional `toolOutput` to `turn/start` for starting or steering a turn with a named function-call output instead of user input.
- Emit standalone outputs as `functionCallOutput` thread items, persist them in durable history, and include them in resumed threads.
- Validate that tool outputs have a name, are not combined with nonempty `input`, satisfy the text-size limit, and use supported image URLs.
## Testing
- Cover standalone tool-output notifications, model input, and resumed history in both legacy and paginated history modes.
- Cover the text-size limit for structured tool output.
GitOrigin-RevId: a1eeec7b9b7de67b1a1c5e829a54552b85ec118b
## Why
App-server clients need the explanation and steering instruction returned with a
misalignment policy violation to offer a user-confirmed continuation. Missing or
incomplete details must continue to behave as a terminal block.
## What changed
- Parse optional misalignment classification, explanation, and steering details
from streamed and HTTP Responses errors and propagate them through core errors.
- Include the details in live app-server `error` and `turn/completed` payloads and
export the corresponding protocol schemas and TypeScript types.
- Keep explanations and steering messages out of serialized rollout events and
redact them from debug output.
- Document how clients can resume with `turn/start` after user confirmation.
## Testing
- Cover streamed, HTTP, and WebSocket-wrapped errors, including malformed and
classification-only details.
- Verify live app-server notifications expose resumable details without writing
the explanation or steering message to the rollout.
GitOrigin-RevId: 329258a444c2cd91d0c57ab1720830b33ddcfac5
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## Why
Paginated thread history should be loaded incrementally through
`thread/turns/list` and `thread/items/list` instead of being fully reconstructed
in `thread.turns`.
## What changed
- Emit `deprecationNotice` when `thread/read`, `thread/resume`, or `thread/fork`
requests full history for a paginated thread.
- Direct clients to omit `includeTurns` for reads or use `excludeTurns: true` for
resumes and forks, then page history through the list APIs.
- Document the deprecation in the protocol schemas and app-server README.
## Testing
- Cover notices for paginated reads, cold and loaded resumes, and forks.
- Verify metadata-only requests, legacy threads, and rejected forks do not emit
the notice.
GitOrigin-RevId: 0d387b46d73608f90b7960120a54af4ef332e510
## What changed
- Make `thread/turns/list`, `thread/items/list`, and `thread/revert` available
without the experimental API capability.
- Stabilize `thread/reverted`, `thread.historyMode`, and the pagination fields
used by `thread/resume` and `thread/fork`.
- Publish the promoted requests, responses, and fields in the stable JSON and
TypeScript schemas, and update the app-server documentation accordingly.
GitOrigin-RevId: 18b8c53c265211597bb1a62fd62f66f4a3df5f06
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## What changed
- Add `serviceTierForTurn` to `turn/start` so a newly started turn can override the service tier without changing the thread's saved tier.
- Treat `"default"` as standard speed and omitted or `null` values as inheriting the thread tier.
- Keep `serviceTier` authoritative for subsequent turns when both fields are supplied, and ignore the turn-scoped override when steering an active turn.
## Testing
- Extend the app-server turn-start test to verify both the one-turn `"default"` override and inheritance on the following turn.
GitOrigin-RevId: 4c2c4db21d8d31617a7a6e6df65bf54834e72383
## What changed
- Record collaboration tool analytics for `send_message`, `followup_task`,
`interrupt_agent`, and `list_agents`, including receiver attribution, duration,
failures, and interrupted calls.
- Include these calls in per-turn subagent tool counts while keeping the existing
`subAgentActivity` output unchanged and omitting additional public collaborator
tool items.
- Extend the collaboration tool schemas with the new tool variants and the
`interrupted` terminal status.
## Testing
- Add an app-server integration test covering successful and failed calls,
receiver attribution, duration, prompt omission, activity items, and turn
counts.
GitOrigin-RevId: e73eaa05c508261e5fc97e7d08d7881a31e04e22
## What changed
- Add a `writeStdin` Guardian action carrying the approval, process, input, and working-directory details.
- Distinguish `command` and `writeStdin` execution approval requests while defaulting missing kinds to `command` for compatibility with older events.
- Render terminal-input review progress, denials, timeouts, and retry actions in the TUI, and record the action separately in analytics.
- Keep terminal-input reviews as child approvals so they do not change the parent command item's lifecycle or reconstructed history.
## Testing
- Cover Guardian serialization, app-server protocol conversion, command history reconstruction, analytics classification, and TUI review flows for terminal input.
GitOrigin-RevId: b083d5e2963bdd23b928644ec03c7eb68ebf2950
## What changed
- Add an `Interrupt` hook event that runs for an active top-level turn before its
interrupted abort event is emitted.
- Flush the turn transcript before invoking the hook and provide the session,
turn, transcript, working directory, model, and permission mode in its input.
- Support command and MCP handlers, including asynchronous commands, with a
one-second default timeout and a three-second maximum.
- Expose the event through hook configuration, managed requirements, app-server
notifications, generated schemas, analytics, and the TUI hook views.
## Testing
- Cover handler discovery, timeout normalization, output parsing, protocol
compatibility, TUI rendering, and interrupt execution ordering.
GitOrigin-RevId: 163fa7c098d94ac2775f6d137f8e916f8ea9b6eb
## Why
Clients need a bounded view of realtime conversations that preserves the order of speech, agent work, and turn lifecycle events without loading the full thread history.
## What changed
- Persist realtime session boundaries, transcript segments, and promoted agent items in paginated thread rollouts.
- Add the experimental `thread/timeline/list` API to page ordinary items, realtime items, and turn boundaries in canonical rollout order. Include `activeRealtimeSessionAtPageStart` so each page can be rendered independently.
- Emit typed `thread/realtime/item/started`, `thread/realtime/item/transcript/delta`, and `thread/realtime/item/completed` notifications around durable realtime items.
- Keep the existing `thread/items/list` response and legacy thread history behavior unchanged.
## Testing
- Cover mixed timeline pagination, realtime-session state at page boundaries, rollout replay, subagent history prefixes, transcript streaming, steering, and promoted agent artifacts.
GitOrigin-RevId: faa2c420192d63e060e8fb32446e3c797422656e
## Why
Unified `@` search could show a plugin alongside the skills it owns, creating duplicate entry points for the same capability.
## What changed
- Add a nullable `pluginId` to `SkillMetadata` returned by `skills/list` so clients can associate skills with their owning plugin without inspecting names or paths.
- Hide a plugin's owned skills from unified `@` results when that plugin is present, while retaining standalone skills and skills with unknown ownership.
- Keep `$` focused on individual skills and apps, and use it consistently as the skills-list shortcut. Preserve the legacy mention behavior when `mentions_v2` is disabled.
## Testing
- Cover plugin ownership in `skills/list` and the updated `@` and `$` composer results.
GitOrigin-RevId: e168cdff8d0c58f74ce4c228a683880a3167775b
## What changed
- Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests.
- Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup.
- Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched.
- Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect.
## Testing
- Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup.
GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723
## Why
A Multi-Agent V2 child can finish after the parent turn that spawned it, so its
successful completion needs to remain associated with that parent turn in
notifications and history.
## What changed
- Add `completed` to `SubAgentActivityKind` and emit the corresponding started
and completed item events on the spawning parent turn when a child succeeds.
- Persist completed activity as a canonical turn item in both legacy and
paginated history, and expose it through app-server history and schemas.
- Render completed activity as terminal in the TUI without counting it as a
separate tool call or tool-runtime event.
## Testing
- Cover successful completion in legacy and paginated history, late updates to
completed parent turns, TUI rendering, analytics, and rollout tracing.
- Verify that terminal child errors do not emit completed activity.
GitOrigin-RevId: 6c71eb8b10e7327611c6af84f70e294e27d94d02
## Why
MCP inventory can be cached or collected separately from a thread's live
connections, so tool availability alone does not describe the current runtime
state.
## What changed
- Add a nullable `runtimeStatus` to `mcpServerStatus/list` for thread-scoped
requests, covering not-started, starting, connected, authentication-required,
failed, cancelled, and disabled connections.
- Observe published connection state without starting or reconnecting servers,
and return an unknown status when no thread is supplied or the active
configuration no longer matches the published registration.
- Show connection state and tool counts in the compact `/mcp` view while
retaining the detailed inventory in `/mcp verbose` and compatibility with
servers that omit `runtimeStatus`.
## Testing
- Cover runtime status transitions, deferred and disabled servers, closed
transports, configuration changes, protocol compatibility, and TUI rendering.
GitOrigin-RevId: e3bb6efe652f0fa8b3c97d5c53e4729b3a87cd91
## What changed
- Add typed `browser_use` settings for history access and per-origin access,
download, upload, and full CDP policies.
- Add typed `computer_use` settings for default app access, macOS bundle IDs,
Windows AUMIDs, and Windows executable identities.
- Expose the merged settings through app-server config reads and generated
Rust, TypeScript, and JSON schemas.
## Testing
- Cover TOML serialization round trips, layered config reads with origin
metadata, and app-server batch writes.
GitOrigin-RevId: 78065f6fec990602071fc81ff639ff97f7ad8cd5
## What changed
- Expand `configRequirements/read` with the Browser/Computer Use umbrella
policy and the complete browser-use policy, including origin-specific access,
download, upload, auto-review, and approval controls.
- Return computer-use persistent approval, default app access, macOS bundle ID
rules, and Windows AUMID and executable rules.
- Export the corresponding v2 protocol types and generated JSON and TypeScript
schemas.
## Testing
- Extend the config requirements RPC test to cover the new browser and
platform-specific computer-use fields.
GitOrigin-RevId: d1be93388701b06312a26853d640401b63b4d535
## Why
Clients that create and negotiate realtime calls themselves need Codex to join
those calls without creating another call or overwriting the client-owned
session configuration.
## What changed
- Add the `existingCall` transport to `thread/realtime/start`, accepting a
client-provided `callId` and optional `realtimeSessionId`.
- Attach Codex over the call's sideband WebSocket without SDP negotiation or a
session update, and reconnect that sideband while preserving transcript
state.
- Default existing calls to realtime v1, support v1 and v3, and reject v2 or
options that would reconfigure the client-owned session.
- Encode call IDs as a single URL path segment for v3 sideband connections.
## Testing
Add protocol, app-server, core, reconnection, authentication-header, and URL
encoding coverage for existing-call attachments.
GitOrigin-RevId: 2046b70566f98efa55381bb1e461ea3cc68256c5
## Why
External tool events may need to enter thread history without a preceding function call and therefore do not have a `call_id`.
## What changed
- Allow `function_call_output` items to omit `call_id` and carry optional `name` and `namespace` fields.
- Preserve named standalone outputs during history normalization and agent forks while retaining existing pairing behavior for outputs with a `call_id`.
- Accept, persist, and forward these outputs through `thread/inject_items`, and update the app-server schemas and documentation.
## Testing
- Cover paired and standalone JSON round trips, history normalization, agent forks, and injected thread history.
GitOrigin-RevId: a3258163a7dc93777c7c3023116fe204819bdbb0
## What changed
- Add experimental `mcpServer/event/stream/start` and `mcpServer/event/stream/stop` requests for hosted apps, plus `mcpServer/event/stream/notification` forwarding.
- Scope subscriptions to the owning app-server connection and subscribed thread, enforce unique IDs and a per-connection limit, and clean them up when the thread is unsubscribed or the connection closes.
- Wait for the MCP active notification before completing startup, retry streams that close immediately, and terminate them when authentication or hosted runtime ownership changes.
## Testing
- Add an app-server integration test covering activation, event forwarding, duplicate subscription rejection, and explicit cancellation.
GitOrigin-RevId: 8a6fc1615adfc5af7e67def3b824fa5909ab3e7b
## What changed
- Add `additional_developer_instructions` to managed requirements and expose it through `configRequirements/read` as `additionalDeveloperInstructions`, independently of ordinary developer instructions.
- Include the managed instructions in model context, emit explicit replacement or removal messages when requirements change, and preserve the current value across compaction, resume, and agent forks without duplication.
- Reject managed instructions whose rendered context exceeds 10,000 estimated tokens.
## Testing
- Cover requirements layering and API serialization, context updates and removal, size validation, repeated model requests, compaction and resume, rollout migration, and agent forks.
GitOrigin-RevId: bc0b70fb7988944c2f68176dff55f5ed61eb46c8
## What changed
- Add `in_app_browser.allow_external_browser_settings_import` to managed requirements, preserving explicit Boolean values through layered composition while leaving an omitted value unset.
- Return the policy as `inAppBrowser.allowExternalBrowserSettingsImport` from `configRequirements/read` and include it in the generated protocol schemas.
- Keep the import policy independent from the in-app browser feature flag and agent Browser Use requirements.
## Testing
- Cover parsing, managed-layer precedence, invalid values, user and session override resistance, and app-server response serialization.
GitOrigin-RevId: efa2621d2b1cf503f1bee2505d9914cb4fb7221d
## What changed
- Recognize `edu_plus` and `edu_pro` as distinct education workspace plans across authentication, backend rate-limit mapping, and app-server account schemas.
- Include both plans in cloud configuration eligibility and use the education usage-limit behavior.
- Display the plans as `Edu Plus` and `Edu Pro` in the TUI status view.
## Testing
- Cover parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, usage-limit messages, and TUI display names for the new variants.
GitOrigin-RevId: bf8add780ae03a3c6d10c4f4afa0da262c37928e
## What changed
- Add an optional `delivery` field to agent message events and app-server
`agentMessage` items, with `"async"` identifying a user-visible message sent
without ending the current turn.
- Preserve the marker through legacy event conversion, thread history
materialization, replay, and generated JSON and TypeScript schemas.
- Require delivery of async agent message completion notifications on the
in-process app-server transport.
## Testing
- Cover preservation of async delivery metadata in thread history.
- Cover delivery-required classification for async agent messages.
GitOrigin-RevId: f92ba25de1293ee271404badfdf0d117d6530329
## What changed
- Add an optional `connectorId` to `mcpServer/resource/read`.
- Forward the selected connector through `x-codex-turn-metadata` for threaded and threadless resource reads, restricting hosted app resources to that connector.
- Update the generated protocol schemas and app-server documentation.
GitOrigin-RevId: 5cc94d703abbbb6086665910c1c9ed5dc7075210
